Yikes! Hacker steals 8,000,000 patient records, demands $10MM

[lblanchard]

Here's a cheerful note about online medical records:

Hackers break into Virginia Health Professions Database, Demand Ransom

If you follow this Washington Post story back to Wikileaks, you can see a replica of the taunting message left on the site's home page.

Comments

[johnpalmer.livejournal.com]

If those records are properly encrypted, they're unreadable without the key.

(Checks the article)

Ah, I see.

What happened was, someone broke in (presumably digitally), erased the records, and encrypted the backups.

So, it *is* loss of the records that's at risk.

When done properly, a database of sensitive information will be encrypted, so that no one can read the records without the key. Now, if someone can get the key, they can pull the unencrypted information, but that's always going to be a risk. That's the same risk as hospital employees revealing confidential health records (e.g., of celebrities).

Attackers can threaten loss of the data - they can erase the files - but typically can't threaten revelation of the data because they can't read the records. And proper encryption takes a good many years to break, even using the fastest publicly-available systems. (The NSA might be able to do it faster - if so, they ain't telling.)

[lblanchard.livejournal.com]

Looks to me like someone broke in (presumably digitally) and left a really snotty message saying that they'd erased the message etc.

They may or may not have actually done it.

If I were the health folks, I'd lock that sucker down tight as a drum until I could be sure they hadn't run off with anything. And I wouldn't say jack until I knew.